I am creating a custom AuthorizeAttribute for my JsonResult controllers to ensure that all requests are coming from an authorized user.
A token is created using @Html.AntiForgeryToken(), which is then added to the headers of the AJAX request.
The contoller method on the server has a [ValidateJsonAntiForgeryToken], which uses checks the token with AntiForgery.Validate() and returns a JSON formmatted error message if the toke is not valid.
When testing everything seemed to be fine until I tried just pasting in a value for the token from a diffent form, and it was accepted.
These are the things that did work as expected:
Navigating directy to the URL (which did work before setting up the AuthorizeAttribute) - returned the error message
No Token - returned the error message Token from other ASP. NET for (the "edit profile" form for this site) - returned the error messa ...
Go to the complete details ...